October 13, 2026—KB5126655 (OS Build 20348.5761)

This cumulative update for Windows Server 2022 (KB5126655), includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. Visit the Windows release health dashboard for the latest status on this release.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Windows Secure Boot certificate expiration

Important: Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

Improvements

This security update contains fixes and quality improvements from KB5122882 (released September 8, 2026) and the out-of-band update KB5129237. The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change.

• [Authentication] Enhanced NTLM auditing is now available on Windows Server 2022 and 2019. The new auditing capabilities provide greater visibility into NTLM authentication, helping administrators identify who is using NTLM, why NTLM was selected, and where NTLM authentication is occurring. This additional visibility can help organizations identify legacy NTLM dependencies and prepare their environments to move toward more secure authentication protocols such as Kerberos. Learn more here: Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions.

• [Date and Time]

  • This update enables permanent Daylight Savings Time (DST) support for British Columbia and Alberta starting in November 2026.

  • This update introduces the new time zone Manitoba Standard Time "(UTC-5:00) Manitoba".

• [Security] This update upgrades the version of cURL included with Windows to version 8.21.0.

• [ReFS security] This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Auditing is enabled by default, while enforcement controls remain disabled by default to give administrators time to evaluate and prepare for future security hardening changes. To learn more, see KB5130741.

• [Storage Spaces] Addresses an issue that might cause some Storage Spaces Direct virtual disks to remain offline after installing a Windows update. This issue occurs when valid tiered storage metadata is incorrectly identified as invalid during recovery, preventing affected virtual disks and dependent workloads from coming online.

• [Distributed Key Manager (DKM)] This update automatically remediates insecure DKM container ACL configurations in AD FS by default. Administrators can opt out of automatic remediation by setting RemediateDkmAcl to 0. This change helps address an elevation of privilege vulnerability that can occur when the DKM container ACL is overly permissive. For more information about how to manage this change, see CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.

• [Audio (known issue)] Fixed: This update addresses an issue where some USB Audio Class 1.0 devices might fail to start or produce audio.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

For more information about security vulnerabilities, see the Security Update Guide and the October 2026 Security Updates.

Windows Server 2022 servicing stack update (KB5126654) - 20348.5739

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Servicing stack updates.

Known issues in this update

Windows Server Update Services (WSUS) does not display error details

After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

How to get this update

Before you install this update

Prerequisite for offline OS image servicing

Make sure that your image includes KB5030216 (09/12/2023) or a later LCU. If not, install it on your offline media before you install the latest update. This LCU updates the SSU version to 20348.1960. That is the minimum SSU version you must have to prevent error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

• Use the Update WinPE script to update an existing Windows image. (Recommended)
• Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

---

File Information

For a list of the files provided in this update, download the file information for cumulative update KB5126655. 

For a list of the files provided in the servicing stack update, download the file information for the SSU KB5126654 - version 20348.5739.

---